Bim Cost Estimation Cwicr

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is coherent for BIM cost estimation, but users should understand it needs project file access, external API/database connections, and a referenced CAD conversion tool.

Before installing, make sure you are allowed to process the BIM model with OpenAI and the configured Qdrant database, use restricted API keys, and verify any DDC RvtExporter or Python dependencies from trusted sources.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The assistant may access local model/report files and connect to external services as part of the estimation workflow.

Why it was flagged

The skill requests filesystem and network access, which is expected for reading BIM files, exporting reports, and using external APIs, but users should be aware of the breadth of those capabilities.

Skill content
"permissions": ["filesystem", "network"]
Recommendation

Use the skill only with intended project files and confirm any network destinations or file outputs before processing sensitive BIM data.

What this means

Misconfigured or over-scoped credentials could expose account usage, costs, or private database access.

Why it was flagged

The skill requires service credentials/configuration for OpenAI and Qdrant, which is purpose-aligned for embeddings and vector search but gives the workflow access to paid or private services.

Skill content
"requires":{"bins":["python3"],"env":["OPENAI_API_KEY","QDRANT_URL"]},"primaryEnv":"OPENAI_API_KEY"
Recommendation

Use least-privilege API keys, keep them in environment variables, and avoid sharing keys in prompts or files.

What this means

Users may need to install or run a separate converter whose provenance and behavior are not verified by these artifacts.

Why it was flagged

The instructions reference an external conversion tool, but the artifact set provides no install spec, binary declaration, or reviewed code for that tool.

Skill content
subprocess.run() is used solely for invoking the DDC RvtExporter CAD conversion tool
Recommendation

Install conversion tools only from trusted sources and review their permissions before using them on proprietary BIM files.

What this means

Project information from BIM/QTO data may be transmitted to OpenAI or a Qdrant endpoint during classification and vector search.

Why it was flagged

The workflow explicitly uses external provider/database connections, likely involving model-derived text, quantities, or classifications.

Skill content
Network permission required for Qdrant vector database and OpenAI embeddings API
Recommendation

Confirm the Qdrant endpoint, understand OpenAI data handling terms, and avoid sending confidential model details unless approved.